 Mike Auty
|
95d3de9317
|
Windows: Convert psscan to the new file interface
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
29cb430a72
|
Codebase: Apply yapf clean-up across the codebase
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
f58c115727
|
Windows: Fix up rebase issues
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
375fc64773
|
Windows: Ensure the appropriate versions are correct
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
d554ae0218
|
Windows: Resolve file_handler type confusion
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
c44074c685
|
Windows: Fix pslist copypasta typo
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
616f7e5d96
|
Windows: Fix up modules dumping
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
b703210024
|
Windows: Refactor names of FileInterfaces
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
3bd462720b
|
Windows: Minor typos with the last patch
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
56266f97de
|
Windows: Fix up rebased malfind and vadinfo
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
032c6b0ac7
|
Windows: Make more use of plugin.open
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
7cadbf32d4
|
Windows: Update dumping code from commit to close
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
e8fb8c929c
|
Plugins: Introduce FileHandlerInterface
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
bbc2ac0018
|
Plugins: Bump required_framework_version and yapf
|
2020-10-29 09:43:16 +00:00 |
|
|
Mike Auty
|
4400c43903
|
Codebase: Yapf across the whole codebase
|
2020-10-27 01:06:24 +00:00 |
|
|
Mike Auty
|
91005e05c7
|
Windows: Ensure pe is always imported from extensions
Fixes #366
|
2020-10-27 01:02:50 +00:00 |
|
|
Andrew Caseandikelos
|
0f60250e4f
|
Add missing requirements specification
|
2020-10-24 23:12:57 +01:00 |
|
|
Andrew Caseandikelos
|
b5d50c055b
|
Add the Mac kevents plugin
|
2020-10-24 23:12:57 +01:00 |
|
|
Andrew Caseandikelos
|
1c709aa09c
|
Add mac_vfsevents
|
2020-10-24 23:12:10 +01:00 |
|
|
Andrew Caseandikelos
|
13ad03f49e
|
Add plugins for enumerate of mac kauth listeners and scopes
|
2020-10-24 23:11:37 +01:00 |
|
|
Mike Auty
|
c53655e40c
|
Poolscanner: Infomasks can be 0
|
2020-10-18 01:07:36 +01:00 |
|
|
Mike Auty
|
82b3477613
|
Objects: Prevent recursion on uninitialized objects
Adds in guards to prevent attribute access if the object hasn't been
initalized correctly (for example from pickling or deepcopy).
Fixes #358.
|
2020-10-18 00:22:09 +01:00 |
|
|
iMHLv2andikelos
|
0d4075355a
|
refs #332 catch invalid address exceptions when reading DllBase
|
2020-10-07 23:16:14 +01:00 |
|
|
Mike Auty
|
7e63ed4815
|
Plugins: Allow None types in the configuration tree as values
|
2020-10-03 22:02:40 +01:00 |
|
|
memoryforensics1andikelos
|
b17a9e1977
|
Update __init__.py
|
2020-10-03 21:45:37 +01:00 |
|
|
memoryforensics1andikelos
|
ce22fc59fa
|
Update __init__.py
|
2020-10-03 21:45:37 +01:00 |
|
|
memoryforensics1andikelos
|
b2aaf53d86
|
Fix XP buges for privileges and environment_variables
|
2020-10-03 21:45:37 +01:00 |
|
|
Mike Auty
|
4c633f3ee9
|
Windows: Add PointerCount check to improve poolscanning
|
2020-10-01 09:06:19 +01:00 |
|
|
Mike Auty
|
640f2584e4
|
Windows: Reduce complexity by using built-in inet_ntop
|
2020-09-24 01:20:37 +01:00 |
|
|
Mike Auty
|
dc8bec199f
|
Windows: Minor formatting and typing improvements
|
2020-09-24 01:01:51 +01:00 |
|
|
Mike Auty
|
b07ce5bd38
|
Crash64: Add support for type 0x01 to crashdump64
|
2020-09-23 20:28:23 +01:00 |
|
|
Mike Auty
|
577c4acec3
|
Layers: Crash64 improve logging
|
2020-09-23 20:28:23 +01:00 |
|
|
Mike Auty
|
c4ff2da9be
|
Layers: Fix context cloning infinite loop with crashdumps
|
2020-09-23 20:28:23 +01:00 |
|
|
Mike Auty
|
31e251e108
|
Layers: Initial crashdump64 implementation
|
2020-09-23 20:28:23 +01:00 |
|
|
iMHLv2andikelos
|
8baf13d3e3
|
refs #333 catch InvalidAddressException instead of AttributeError when accessing DLL timestamps
|
2020-09-23 19:27:37 +01:00 |
|
|
memoryforensics1andikelos
|
9048c04aa4
|
envars plugin
parse environment variables
|
2020-09-22 20:03:19 +01:00 |
|
|
Mike Auty
|
c436882f4d
|
Windows: Fix up the sids JSON slightly
|
2020-09-22 19:49:34 +01:00 |
|
|
memoryforensics1andikelos
|
0f34c82b6c
|
Update privileges.py
|
2020-09-22 19:49:01 +01:00 |
|
|
memoryforensics1andikelos
|
004fc1480b
|
Update privileges.py
|
2020-09-22 19:49:01 +01:00 |
|
|
memoryforensics1andikelos
|
15bce1ce72
|
privileges plugin
added privileges plugin
|
2020-09-22 19:49:01 +01:00 |
|
|
Mike Auty
|
f3e77ad645
|
Windows: Minor typos and JSON name change in sids plugins
|
2020-09-22 19:38:36 +01:00 |
|
|
memoryforensics1andikelos
|
d1264e0134
|
Update __init__.py
|
2020-09-22 18:30:54 +01:00 |
|
|
memoryforensics1andikelos
|
30be4ee2ec
|
fix get_sids function
fix get_sids function in broken images
|
2020-09-22 18:30:54 +01:00 |
|
|
memoryforensics1andikelos
|
31080ad416
|
fix
|
2020-09-22 18:21:58 +01:00 |
|
|
memoryforensics1andikelos
|
a5d5ff2bda
|
getsids getservicesids
|
2020-09-22 18:21:58 +01:00 |
|
|
Mike Auty
|
77312e193a
|
Plugins: Update the banner plugin filename.
|
2020-09-22 00:25:20 +01:00 |
|
|
Mike Auty
|
0ac26d40a1
|
Plugins: Support mac banners as well
|
2020-09-22 00:21:13 +01:00 |
|
|
Mike Auty
|
0a57a49572
|
Plugins: Add LinuxBanners plugin
|
2020-09-22 00:21:13 +01:00 |
|
|
Andrew Caseandikelos
|
e58e55b433
|
Update code for better variable names and minor version bump
|
2020-09-16 17:35:49 +01:00 |
|
|
Andrew Caseandikelos
|
afe39eee1b
|
Add new method for safe walking of generic list heads. Convert pslist to use it.
|
2020-09-16 17:35:49 +01:00 |
|